Analysis
-
max time kernel
2s -
max time network
4s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
27-06-2024 17:11
General
-
Target
16d160211b09b6c33b42cf09eef5ab7b_JaffaCakes118.exe
-
Size
165KB
-
MD5
16d160211b09b6c33b42cf09eef5ab7b
-
SHA1
d704039efefb0192a95b5a759e9895f771e42c05
-
SHA256
122061a470d5045affca5710bf56486789465ca07de2857b3fc56a92a3d50dc7
-
SHA512
c611357ef07418a54a174b2d58a216105c0db2b106d54231dece2865e53a5fc749ef7199398d90ff00910dbbb1a97a74fe5fb914caafe2ccd238e24f166a2948
-
SSDEEP
3072:YKGqvvBqKANCn3YGXoMHkufBoEQ2DX/HIjv+j3gELX/ROD:Yav0KmCn3YGX1HVXKv43gET0D
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16d160211b09b6c33b42cf09eef5ab7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16d160211b09b6c33b42cf09eef5ab7b_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
-
Filesize
264KB
-
Filesize
264KB